File systems, in operating system environments, such as UNIX, have evolved into complex implementations with many features. These file systems present a hierarchical tree view of a file name space and support large amounts of data and numbers of objects at very high performance levels. Yet, one characteristic that has changed little is the authorization security models of these file systems. The fundamental problem is that, on operating systems such as UNIX, LINIX and even to some degree WINDOWS, the degree to which the native file systems do not support robust security models. For example, with UNIX, the security of an individual file may be specified is fairly limited in coarse grain. A user and a group owns the file. In this model, file access is based on a set of “mode” bits that grant permissions based on the file object's owning user and group. Some file systems support a more robust security model based on access control lists (ACLs) where more security is placed on a file to enable control of various users' access to files. The problem with this approach is that these models are very different across different versions of operating systems. This inconsistency leads to another problem that each system requires individual and separate administration of each system and each system requires a separate set of administration methods. When viewing the Information Technology (“IT”) infrastructures of large corporations and other entities, there is a growing need for stronger more granular security controls in file systems. This need is driven by large-scale commercial usage of these file systems, data sharing with Internet based applications, an increased focus on IT security, and the desire to control IT administration costs. From an IT cost perspective, there is a need to have enhanced security in an efficient way. This objective leads itself to being able to define the security rules and procedures centrally for all of an entity's systems that could be accessed so that there would be a central point of administration, control and verification of rules. The IT structures of today need better security and a more efficient way to implement the security. An efficient way to do that is to provide a file system security model that can be applied uniformly across a large number of systems using a centrally managed set of policies that is administered identically regardless of the target file system implementation or hardware platform.
Ideally, it would be desirable to add extended attributes describing properties such as authorization policy to the file system object's attributes. However, file systems, such as UNIX, are typically byte stream oriented and do not support mechanisms to add attributes beyond the classic UNIX attributes which are typically the object's owner, size, modification and access times, and mode bits.
A set of techniques is needed which allows unique identification of an accessed resource regardless of way in which it was accessed. In addition, the techniques must allow the specification of attributes in terms of an object's common path name in a manner that maps to the same unique file system resource regardless of the representation used at access time. These techniques should be efficient so they impose minimal impact the file system's native performance characteristics. They must allow for quick recognition and processing of attached attributes at access time. They must also accommodate changes in defined attributes and object changes in the file systems to which they are applied.